Ransomware at a New Jersey business: who to call and what to do first
- Isolate affected computers from the network, and call your IT help on a different channel like a phone.
- Report to CISA, your local FBI field office, the FBI's IC3 or your local Secret Service field office.
- Do not wipe systems yet. Evidence helps find how they got in.
- If New Jersey residents' personal data was accessed, the state breach law asks you to report to the State Police before notifying customers.
Free 30-minute review
Tell us about your office. We tell you what we would fix first, in plain words, whether or not you hire us.
You come in and the files will not open. A message demands payment. For a New Jersey business, the next hour is about calm steps in the right order.
This is a short call sheet. Print it and keep a paper copy. We use guidance from CISA and the FTC. It is not legal advice.
Step 1: Isolate
Cut the affected computers off from the network. Unplug the cable or turn off Wi-Fi. CISA's ransomware guide says to isolate quickly, and to power devices down only if you cannot disconnect them.
Step 2: Call for help, not by email
CISA suggests out-of-band communication, like phone calls, so attackers do not learn you have noticed. Call, in this order:
- Your IT provider or incident response firm.
- Your cyber insurer, if you have one. Many policies have a claims line and rules on who you may hire.
- Your lawyer.
Step 3: Keep the evidence
Do not wipe or rebuild yet. You need to know how they got in, or they come back. CISA lists preserving forensic evidence as part of containment.
Step 4: Report it
CISA says to report to CISA, your local FBI field office, the FBI IC3, or your local US Secret Service field office. The FTC adds that you should tell your industry regulators.
Step 5: Check New Jersey notice rules
If New Jersey residents' personal information was accessed and it was not encrypted, the state law asks you to report the breach to the Division of State Police before you tell the customers. Read our plain-words guide to N.J.S.A. 56:8-163. If you handle patient data, see our medical and dental guide.
What about paying?
The FTC notes that law enforcement does not recommend paying the ransom. Paying does not promise your files back. Make this decision with law enforcement and your responders. Do not make it alone, in a panic.
How do you get back to work?
CISA's guidance is to rebuild systems in priority order and restore from offline, encrypted backups, without reinfecting clean systems. Then reset passwords and close the way in.
That is why backups matter more than almost anything. Our New Jersey backup guide covers a plan that survives an attack.
Who do I call first after a ransomware attack?
Call your IT provider first, on a phone number you saved before. Then call your cyber insurer if you have one, since many policies have a claims line and rules about who you may hire. Then report it to law enforcement, as in step 4.
Do not use the infected network to plan
Attackers may be able to read your email. Use phones and a messaging tool that was not affected. Keep the group small and the messages short.
What should be on your one-page call sheet?
- IT provider urgent line.
- Insurance claims line and policy number.
- Your lawyer.
- Where the offline backup is and who can get it.
- Who tells staff, and who tells customers.
Print it and keep a copy off the network. For the other side of the story, read our backup plan for New Jersey small business and the New Jersey breach law guide.
Before it happens
- MFA on email and remote access.
- Updates on a schedule. Do not leave remote access open to the internet.
- One backup copy offline, and a tested restore.
- A written one-page plan with phone numbers.
- Staff who know how to report a strange email.
How we can help
We help New Jersey businesses get ready, and we can be the call you make in the first hour. Book a free 30-minute review and we will write your call sheet with you. See our cybersecurity service.
Common questions
Who do I report ransomware to in New Jersey?
CISA lists reporting to CISA, your local FBI field office, the FBI Internet Crime Complaint Center (IC3), or your local US Secret Service field office. If personal data was accessed, also see the New Jersey breach rules.
Should I pay the ransom?
The FTC notes that law enforcement does not recommend paying. Talk to law enforcement and experienced incident responders before you decide.
Should I turn the computers off?
CISA says to isolate affected systems and power them down only if you cannot disconnect them. The FTC says to disconnect without powering down.
How do I recover?
Rebuild in priority order and restore from offline, encrypted backups, taking care not to reinfect clean systems.
Who do I call first after a ransomware attack?
Your IT provider, on a number you saved earlier. Then your insurer, then report to law enforcement.
Book a free 30-minute review
Tell us what is not working. We will look at your setup and tell you what we would change, whether or not you hire us.
Book the review ●●● ●●●-●●●●